PLC Simulator
Product-led Modbus tutorial

Modbus TCP PLC Tutorial: Build and Diagnose a Poll

Build a small, known-good Modbus TCP poll before adding a SCADA package, gateway or large register block. The tutorial alternates explanation with a live request grader so every step produces evidence.

20 minutes PLC learners, commissioning technicians and SCADA integrators
Open the Modbus workbenchRead the method

Follow the workflow

Learn one step, use the product, inspect the evidence.

01

Separate the TCP envelope from the Modbus PDU

Modbus TCP adds a seven-byte MBAP header containing transaction ID, protocol ID, length and unit ID. The function code and data fields remain in the protocol data unit. During diagnosis, first decide whether the failure is TCP reachability, MBAP framing or the Modbus request itself.

Do this in the product

In the workbench, start with the “Read two holding registers” challenge. The returned evidence shows the request PDU without hiding it behind a driver.

Open the exercise
02

Translate 40001 into address 0

A vendor table may label the first holding register 40001. The request normally transmits the zero-based data address 0. Sending decimal 40001 as the 16-bit address is a classic off-by-reference error. Confirm the manual’s convention because some tables already publish protocol offsets.

Do this in the product

Keep function 03, set address 0 and quantity 2. Run the public grader and inspect the expected 03 00 00 00 02 PDU.

Open the exercise
03

Prove one contiguous block

Request the smallest useful range. A quantity of two holding registers should produce four data bytes. If that succeeds, expand cautiously while respecting the device’s documented maximum and avoiding unmapped gaps.

Do this in the product

Save the known-good configuration to your account so it becomes the baseline for later fault tests.

Open the exercise
04

Use exceptions as evidence

An exception function has bit 7 set: a failed function-03 request returns 83. Code 02 means illegal data address, which proves the server understood the function but rejected the requested map. Timeouts point to a different branch of the fault tree.

Do this in the product

Pro learners can run the exception-diagnosis challenge and keep the graded result in their attempt history.

Open the exercise

Core concepts

Know what the evidence means.

The simulator creates a repeatable result; these concepts make that result transferable to real vendor software and supervised practical work.

Port and transport

Modbus TCP commonly uses TCP port 502. A successful socket connection does not prove the unit ID, function or register map is correct.

Transaction ID

The client chooses a transaction ID and the server echoes it, allowing several outstanding requests to be matched to their responses.

Register width

A Modbus register is 16 bits. Thirty-two-bit integers and floats occupy multiple registers, and byte/word order is vendor-specific rather than solved by the core protocol.

Common mistakes to avoid

  • × Using 40001 as the transmitted address instead of 0
  • × Polling through an unmapped register gap
  • × Treating a TCP connection as proof that the request is valid
  • × Guessing float word order without a documented test value

Continue in the workspace

Turn this tutorial into retained training evidence.

Run the foundation exercise publicly, then use a subscription for advanced challenges, saved configurations, full attempt history, sharing, assigned paths and team reporting.

Open the Modbus workbenchCompare plans

Related learning surfaces

Continue with Modbus RTU and RS-485 SCADA training path PLC instruction reference
Follow-along tutorial questions

Questions before you continue.

They share function codes and data models. TCP uses an MBAP header over Ethernet; RTU uses a compact binary frame with CRC and strict serial timing.